Date: Wed, 19 Feb 2003 21:18:13 -0800 From: Lars Eggert <larse@ISI.EDU> To: George Hartzell <hartzell@kestrel.alerce.com> Cc: freebsd-questions@freebsd.org, freebsd-mobile@freebsd.org Subject: Re: FreeBSD 4.7-REL-p3 and an IPsec connection to Linksys BEFVP41 Message-ID: <3E546515.4000703@isi.edu> In-Reply-To: <15956.23535.146549.735318@rosebud.alerce.com> References: <15956.23535.146549.735318@rosebud.alerce.com>
next in thread | previous in thread | raw e-mail | index | archive | help
[-- Attachment #1 --] On 2/19/2003 8:39 PM, George Hartzell wrote: > I'd like to set up an IPsec connection between my laptop running > FreeBSD 4.7-REL-p3 and a Linksys BEFVP41 router w/ built in IPsec > capability. > > I've found a number of sites w/ information on setting up ipsec > between a pair of FreeBSD machines, including: > > http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/ipsec.html > http://www.freebsddiary.org/ipsec-tunnel.php > http://www.daemonnews.org/200101/ipsec-howto.html > http://www.bsdtoday.com/2002/April/Features671.html > > But none that talk about getting FreeBSD's IPsec talking to anything > non-FreeBSD. > > All of the methods are based on setting up a gif tunnel and passing > the packets over that. Not really. There are a number of different ways to set this up, and only one (valid) one uses gif tunnels: 1. Use IPsec transport mode. The handbook (1st link) explains how to set this up. 2. Use IPsec tunnel mode. Again, the handbook describes the setup, so does the bsdtoday article. (Note that these two do not use IPIP gif tunnels!) 3. Use an IPIP gif tunnel and IPsec transport mode, as described in draft-touch-ipsec-vpn, and the daemonnews article. This is an alternative to IPsec tunnel mode that has advantages when running dynamic routing - you don't seem to, so you should stick to vanilla IPsec, esp. since you only control one end. You do NOT want to follow the freebsddiary article, which sets up parallel IPIP gif tunnels and IPsec tunnel mode SAs. It abuses the duplicate tunnels for routing, and can result in subtle interactions that can make your traffic go silently unencrypted. (I've contacted the author a long time ago, but he doesn't seem to belive in fixing "diary" entries.) > I've tried a number of variations on the > recommended recipes, and at best I can watch the isakmp packet going > from the laptop towards the router and get see an icmp packet back > from the router that suggests the the gif tunnel isn't what it wants > to see (sadly, I didn't save the exact message, but can recreate it if > it's important enough). Without a lot more information about your configuration, we can only guess at the issues. > So, the quick question is, has anyone set up a FreeBSD laptop as a > "road warrior" to an IPsec router? I'd appreciate any pointers. All three aproaches above can be made to work, as explained by the tutorials you cite. The question is, which one is supported by your Linksys box? Lars -- Lars Eggert <larse@isi.edu> USC Information Sciences Institute [-- Attachment #2 --] 0 *H 01 0 + 0 *H 080fErtcvE.0 *H 01 0 UZA10U Western Cape10U Cape Town10U Thawte Consulting1(0&U Certification Services Division1$0"UThawte Personal Freemail CA1+0) *H personal-freemail@thawte.com0 000830000000Z 040827235959Z01 0 UZA10U Western Cape10U Cape Town10 U Thawte1 0U Certificate Services1(0&U Personal Freemail RSA 2000.8.3000 *H 0 32c %E>nx'gڈD)c5*mp<ܮto034qmOe KaU5u'rװ |CBPQ<9TIf - ki N0L0)U "0 0 10UPrivateLabel1-2970U 0 0 U 0 *H 1KG]qSl]y=&b""I'{9$ *8PUl LGl X1B li+@]jy.%݊ Z<D&iHΥbb090%A0 *H 01 0 UZA10U Western Cape10U Cape Town10 U Thawte1 0U Certificate Services1(0&U Personal Freemail RSA 2000.8.300 020824185339Z 030824185339Z0T10 UEggert1 0 U*Lars10U Lars Eggert1 0 *H larse@isi.edu0"0 *H 0 6Fxΰ7a ED&0+Dj)ֽXCUcnleijmz~S0J jWV~ 1^({IݛLjӖ ao:bP}WLVܱ욗cD ɖ_Kv.A(W4 9;Z8-uXE 6b @_0%#d` Rto5 L0R`w@7 r Hcc U 3%7 N_o V0T0*+e!0 00L2uMyffBNUbNJJcdZ2s0U 0 larse@isi.edu0 U 0 0 *H ]Ȕ,fK< cj RZeLa n@Z6,= fK?yO#8+ Ni*LSfpQg <(aӒ$kTx_AL1>ގ|S090%A0 *H 01 0 UZA10U Western Cape10U Cape Town10 U Thawte1 0U Certificate Services1(0&U Personal Freemail RSA 2000.8.300 020824185339Z 030824185339Z0T10 UEggert1 0 U*Lars10U Lars Eggert1 0 *H larse@isi.edu0"0 *H 0 6Fxΰ7a ED&0+Dj)ֽXCUcnleijmz~S0J jWV~ 1^({IݛLjӖ ao:bP}WLVܱ욗cD ɖ_Kv.A(W4 9;Z8-uXE 6b @_0%#d` Rto5 L0R`w@7 r Hcc U 3%7 N_o V0T0*+e!0 00L2uMyffBNUbNJJcdZ2s0U 0 larse@isi.edu0 U 0 0 *H ]Ȕ,fK< cj RZeLa n@Z6,= fK?yO#8+ Ni*LSfpQg <(aӒ$kTx_AL1>ގ|S10001 0 UZA10U Western Cape10U Cape Town10 U Thawte1 0U Certificate Services1(0&U Personal Freemail RSA 2000.8.30%A0 + 0 *H 1 *H 0 *H 1 030220051813Z0# *H 1.$OMu^;#d 0R *H 1E0C0 *H 0*H 0 *H @0+0 *H (0 +71001 0 UZA10U Western Cape10U Cape Town10 U Thawte1 0U Certificate Services1(0&U Personal Freemail RSA 2000.8.30%A0 *H 101 0 UZA10U Western Cape10U Cape Town10 U Thawte1 0U Certificate Services1(0&U Personal Freemail RSA 2000.8.30%A0 *H X ;d5TY1oa@VR|8|̰0xoW7Q釛6Y%L|PLCuWr'2~X:"?E& B lHԢ<q܊kپx(<]H{y=]@NqHT!I#Բxk˥ 0v9عrIFd1i_Dy o-{S1Nxyi~Z{Gp: !
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?3E546515.4000703>